Featured Post

Welcome to the Forensic Multimedia Analysis blog (formerly the Forensic Photoshop blog). With the latest developments in the analysis of m...

Friday, December 30, 2011

Ill. Supreme Court: Police must preserve video evidence even in misdemeanor cases

From the Chicago Tribune: "The Illinois Supreme Court says video has become so common in law enforcement that police must preserve it as evidence even in misdemeanor cases.

The court upheld sanctions Friday in a case where police erased video of a drunken driving arrest. The defendant told prosecutors she intended to fight the charges and wanted the video, but police still followed their policy of destroying videos after 30 days.

As punishment, the trial judge barred the arresting officer from testifying about anything that took place when his squad-car camera was running.

Cook County prosecutors appealed, saying that would cripple their case.

But the Supreme Court says the video should have been saved and the judge was within his rights to limit testimony when that didn't happen."

Enjoy.

Thursday, December 29, 2011

JPEG Snoop

I posted this to ImpulseAdventure's site to ask a question about JPEGSnoop: "Take a photo with your camera. Upload it to Facebook. Download it from Facebook. Run the downloaded image through JPEGSnoop.

The software will show it as edited. Essentially, Facebook recompresses the image on your computer before it uploads it to their servers. Gone are the markers from your camera.

Other than the recompress - there's no actual "editing" as most people use the term. Nothing added or deleted to the photo.

What are your thoughts on this? Is it possible to refine the terms? Something like this could be listed as double quantization - resaved? How about a DCT histogram to point to the integrity of the image in spite of the double quantization?

Here's their response:
"You're absolutely right Jim... The term "edited" is used very loosely. Really, all that is meant is "not-original". As it is incredibly hard to differentiate simple resaving (recompression) from an edit+resaving, I haven't made any efforts to report "double quantization". I'm definitely open to ideas on suitable terminology. Of course most people are interested in determining if an image has been altered in the more general sense of the word (ie. modified to misrepresent reality), rather than simple resaving, resizing, etc. Regarding the DCT histogram, what type of data were you thinking could be interesting from a histogram perspective? Thanks!"

Wednesday, December 28, 2011

From North Korea, an Altered Procession

Here's an interesting piece of photo editing from North Korea courtesy of the NY Times.

Enjoy.

Friday, December 23, 2011

Merry Christmas

I want to take the opportunity to thank everyone for their support over the years.

Here's to you. Happy Holidays!

Enjoy.

Wednesday, December 14, 2011

Stanley Cup riot suspects await first day in court Wednesday Read it on Global News: Stanley Cup riot suspects await first day in court Wednesday

This just in from GlobalBC: "...Looters stole $424,000 worth of merchandise from the store once the heavy-duty glass and security gate was smashed by the mob. Damage to the store was $225,000 and Powell said they are still working with the company’s insurers to see what will be covered under their policies.

He said they have passed on their state-of-the-art security video footage to police, who took over 5,000 hours of riot footage to a special lab in Indianapolis, and will have the company’s security experts ready to appear in court if needed.

Powell said they have clear video of the first looters coming in to the store after the doors and windows were destroyed.

“They had a shopping list,” Powell said, adding they hope to recover some of the stolen items. “They were stealing specific products, specific brands. It was like a boxing day sale with no cash register.”

Powell said London Drugs has been careful to provide footage they believe will stand up to any defence lawyers’ challenges.

“Our track record is over 90 per cent conviction rate once we show the video,” he said past shoplifting cases. “I have great faith in the justice system.”

Click here to read the rest of the story.

Enjoy.

Tuesday, December 13, 2011

The murder of Police Officer Peter Figoski

Here are a few stories about the senseless murder of Police Officer Peter Figoski:

Why was he freed to kill? - NY Post editorial.

Fallen Finest - NY Post.

NYPD HERO COP KILLED BY RECENTLY-RELEASED VIOLENT FELON WITH A WARRANT - theblaze.com

Post launches fund for hero cop’s daughters - NY Post

Please keep the Figoski family in your thoughts and prayers.

Monday, December 12, 2011

New School Puts Modern Forensics at Afghan Police Fingertips

From DVIDS Spc. Ken Scar: "Afghanistan took another big step toward autonomy Nov. 29 with the opening of the Afghan Criminal Techniques Academy and Laboratory.

The ACTA will train Afghan law enforcement officers in the forensic disciplines, which to this point have not been widely practiced in the Afghan justice system.

Figure 1: Afghan National Police member Mohammad Shafiq (right), an instructor-in-training at the new Afghan Criminal Techniques Academy and Laboratory on Bagram Air Field, shows fellow policemen and students Eqeban (left), and Habiburahman how to gauge a bullet casing with digital calipers in one of their brand-new classrooms.

The ACTA will teach essential techniques like fingerprinting, forensic photography, and firearms/tool marking and will eventually include instruction in the most modern technological and chemical evidence testing such as DNA processing.

“We will be able to find criminals and bring them to justice [with this forensic capability],” said Mohammad Shafiq, a member of the Afghan National Police who will be an instructor at the ACTA. “It will also help [Afghan citizens] be more confident in their police system.”

Initially, the academy’s instructors will be from the U.S., but over time Afghan law enforcement professionals will work as assistant instructors.

To make that transition as trouble-free as possible, the 10-week program at the ACTA will be supplemented by American experts embedded in Afghan National Police offices in each region of the country, guiding ACTA graduates through their first year of work.

“We’ll mentor these guys and make sure there aren’t any mistakes being made and that the product going out is accurate,” said Jon Eizinger, a U.S. civilian forensic specialist who will train instructors for the ACTA. “It’s a safety net that’s built in to make sure this goes smoothly and that these guys develop until they are able to be self-sufficient.”

The technology and knowledge provided by the new academy will greatly improve the credibility of Afghanistan’s criminal justice system, said Afghan National Army Col. Said Rahmatullah Quraishi, who is the ANP Assistant Director of Criminal Technique.

“In the old system the judges projected their opinion on cases because we didn’t have [forensic] technology,” said Quaraishi. “With this new ability [to present hard evidence] they will not be able to do that.”

The ACTA will play a pivotal part in Afghanistan’s transition from a judicial system where the burden of proof lies on the accused to one where a person is considered innocent until proven guilty.

Many Afghan citizens have been skeptical of their new government’s justice system, said Shafiq, but the new abilities to present evidence at trials, provided by ACTA schooling, will go a long way toward turning the tide of opinion.

“Now the people can have a lot more trust in us,” he said."

Enjoy.

Monday, December 5, 2011

Subjecting forensic analysts to cross-examination is good policy.

From the NY Times: "ON Tuesday, the Supreme Court will hear oral arguments in Williams v. Illinois, the latest in a string of cases addressing whether the Sixth Amendment’s confrontation clause — which gives the accused in a criminal case the right “to be confronted with the witnesses against him” — applies to forensic analysts who produce reports for law enforcement. In other words, should an analyst responsible for, say, a fingerprint report have to show up at trial to face questions about the report?

A logical application of the law produces an easy answer: Yes. The court has defined a “witness against” a defendant as a person who provides information to law enforcement to aid a criminal investigation. That is exactly what forensic analysts do.

Subjecting forensic analysts to cross-examination is also good policy. According to a recent National Academy of Sciences study, forensic science is not nearly as reliable as it is perceived to be. DNA specimens, for instance, are sometimes contaminated; fingerprint, ballistics and even run-of-the-mill drug and alcohol analyses depend on human interpretation and thus are subject to error. Worse, investigations over the past decade have revealed outright incompetence and fraud in many crime labs. So it makes sense to subject the authors of lab reports to cross-examination — a procedure the court has called “the greatest legal engine ever invented for the discovery of truth.”

Despite all this, the Supreme Court has been sharply divided on the issue. In similar cases in 2009 and earlier this year, in which I represented the defendants, Chief Justice John G. Roberts Jr. and Justices Anthony M. Kennedy, Stephen G. Breyer and Samuel A. Alito Jr. accepted claims by state governments that, simply put, confrontation in this context costs too much. It is far more efficient, these justices contend, to let analysts simply mail their reports to court. Having to appear at trials pulls them away from their labs, and only occasionally proves more revealing than their written testimony. Hence, these justices maintain, “scarce state resources” are better committed elsewhere.

Given that several states have long required forensic analysts to come to court, one might think that this financial argument would not have gained much traction. Justice Antonin Scalia, in fact, called the argument a “bogeyman.” But the four dissenting justices not only accepted it but deemed it powerful enough to trump the commands of constitutional text and precedent.

The same battle lines are being drawn again in the case to be heard next week (for which I have signed a friend-of-the-court brief in support of the defendant). In Williams v. Illinois, the defendant contends that he should have been given the right to confront an analyst in the lab that generated a DNA profile from the crime scene. Yet the State of Illinois argues that the extra cost of bringing that witness into court was unnecessary, because the defendant had an opportunity to question a different analyst who compared that profile to the defendant’s and concluded that it was a match.

A friend-of-the-court brief by the Manhattan district attorney’s office pushes the state’s argument one step further, warning that a ruling in the defendant’s favor would prove so costly that it would “force prosecutors to forgo forensic DNA analysis” in future cases. Consequently, the brief continues, defendants in rape and murder cases “might well be prosecuted solely on the basis of eyewitness testimony,” which is notoriously unreliable and could lead to convictions of many “innocent individuals.”

This is an outrageous assertion. Nothing in the outcome of the Williams case, which deals only with the admissibility of evidence, will preclude prosecutors from using DNA testing to determine whether they have the right guy. Presumably, prosecutors concerned about whether they imprison (or, in some states, execute) innocent people will continue to do such testing whenever possible, no matter how much it will cost to enter the results as evidence.

But the assertion in the Manhattan district attorney’s brief reflects — in a particularly dramatic way — some prosecutors’ belief that they can bully the court into refusing to enforce a constitutional guarantee simply by arguing that such enforcement would be an administrative and financial burden.

There’s nothing new here. In the 1963 case of Gideon v. Wainwright, Alabama and several other states filed a brief urging the court to refrain from interpreting the Sixth Amendment’s guarantee of the “assistance of counsel” to require states to provide lawyers to poor defendants accused of felonies. The brief said such a rule would impose on states “an unbearably onerous financial burden to pay the fees of attorneys.”

The court, of course, was not moved. States have adapted. And the Gideon case has become a cornerstone of American jurisprudence. It’s almost impossible now to imagine how a trial could be considered fair without that basic procedural guarantee.

The court should follow this lesson in Williams and refuse to be cowed by prosecutorial bogeymen. It unquestionably costs money to deliver the fundamental demands of justice. But the price is not nearly so high as the states usually claim. And the price of failing to enforce basic procedural rights is, in the long run, much higher ..."

Click here to read the whole article at the New York Times.

Enjoy.

Friday, December 2, 2011

Teamwork

I was recently testifying about my work in downloading the contents of a cell phone's memory card. In these types of cases, the investigator will request certain actions be performed and (usually) a search warrant will grant me the authority to search ... as well as to define the parameters of the search. As the investigator is usually responsible for the warrant, (usually) the request terms and the warrant terms are one and the same. Usually.

Many times, these downloads take place before an attorney is assigned to the case ... or even before there's a case. It may be a witnesses' device, or the suspect may be questioned and released. Once we give the phone back ...

As an analyst, I'm limited in searching a device by the terms of the warrant or consent letter. As I'm not the investigator, I can only advise, then do what I am ordered to do by the court or investigator.

So ... back on the stand, I'm asked if I did an analysis, looked for certain items, etc. Answer ... no. The request was only for a download of the contents. No time (or request) was given for analysis.

Part of teamwork is anticipating what each member of the team will want/need. Part of that is communication. "Just dump the contents and we'll worry about the rest later ..." works great when later actually happens. But, when I'm subpoenaed 2 years later, with no further communication happening, there's not much I can do to help ... other than state and affirm that I did perform a download, using write blockers, etc.

Part of the solution to this problem is coming soon. I'm working on "boiler plate" warrant language for a variety of scenarios and jurisdictions. I'm also working on some forms that can be modified for use at your agency. We may only get one shot at the evidence. I'll do what I can to help you get the most out of that one shot. When it's done, it'll be up on the book's web site. Stay tuned for more on this.

Thursday, December 1, 2011

Busy Busy Busy

It's the busy season. School's wrapping up for the year, investigations are being finalized, and there's so much to do. On my to-do list for the month is a thorough testing of Kinesense, along with a review. I'm also working on a new set of give-aways for owners of my book. More on that later.

In the mean time, enjoy the winter season.

Monday, November 14, 2011

Avid Media Composer 6 - wait for a bit

For those considering updating Media Composer to version 6, wait for a bit and make sure that your system can handle the upgrade. MC6 is a 64-bit app. If your hardware is not 64-bit, stay with MC5.5 for now.

Another thing to consider is that the Ocean Systems plug-ins for Avid Media Composer are 32-bit, and thus won't work with MC6.

Enjoy.

Friday, November 11, 2011

Digital evidence becoming central in criminal cases

This just in from MSNBC: "... Drew Findling, an Atlanta attorney and chairman of the National Association of Criminal Defense Lawyers’ Forensic Disciplines Committee, notes that e-evidence might just as easily create an unshakable alibi, which is why he routinely hires experts to examine equipment and data.

“You want to have the equipment examined to determine the reliability, both from a chronological and content standpoint,” he said. “And there are times when that evidence is of an exculpatory nature, so you want to make sure that you gain access to it – whether it’s a computer or an iPhone or whatever – and that you preserve that evidence immediately.”

Courts already are wrestling with the challenges presented in general by electronic evidence, which has become almost ubiquitous in both civil and criminal cases.

“Electronic evidence is admitted in almost every trial in America, whether it’s a phone bill or electric bill or a document that’s created, stored or transmitted electronically,” said Mark D. Rasch, director of cybersecurity and privacy consulting at the technology services company CSC and former head of the Justice Department’s computer crime unit. “… When you think about it, even a crime scene photograph is electronic evidence now ...”

They go on to say ..."Experts have different views of those to-and-fro battles.

Rasch, the former Justice Department official, said that courts often impose higher requirements on digital evidence than they do with physical documents, such as letters.

“We demand a (greater) degree of certitude for certain kinds of electronic evidence than is demanded in the physical world. … A lot of it has to do with the general unease we have with electronic evidence. We’re not sure it’s reliable, that it hasn’t been tampered with.”

But others worry that current laws – and the judges who enforce them – have failed to adequately consider that electronic evidence is “inherently malleable or ephemeral.”

Among them is Steven Teppler, a partner in the Chicago law firm Edelson McGuire and co-chair of the American Bar Association’s Digital Evidence Committee. He is part of what he describes as a growing movement within the legal profession to have digital evidence deemed “hearsay,” and thus generally inadmissible in legal proceedings unless its reliability can be demonstrated.

“Unless we change the rules of evidence to require a higher level of reliability, you have this built in problem where people say, ‘It comes out of the computer, therefore it must be reliable,’” he said.

But that doesn’t account for the fact that programmers create the software that instructs those machines to generate data, Teppler said ..." Read the whole story by clicking here.

Enjoy.

Wednesday, November 9, 2011

Best Practices - Quality Control Survey

I putting together some stats for my PhD work. One of the issues that I'm addressing is quality control. In attempting to gather qualitative data, it's essential to get to the point quickly and to have specific questions that will yield specific results.

One of the questions regarding quality control focusses on the qualifications of the person conducting the process. In other words, does the QC person know enough to know when a work product is wrong/bad?

Case in point, if your SOPs say that you should always get the native or proprietary data (whenever possible), and the technician returns with a DVD movie that was captured via the analogue output (and the system does offer a digital output option) ... would your QC person know to flag it for further enquiry? Put another way, does simply making sure that the video "plays" on the QC person's PC suffice?

If you'd like to participate in this survey, please let me know.

Enjoy.

Tuesday, November 8, 2011

Helpful shortcuts 3

Often, it's desirable to group your layers in order to keep them better organized. Here's the quick and easy shortcut. Select the layers that you would like to group together (Cmd + click). Then, to group those selected layers, type Cmd + G.

Enjoy.

Monday, November 7, 2011

Helpful shortcuts 2

Zooming in and out is a necessity when working on a large image. Here are the keyboard shortcuts from zooming in and out.

Zoom in: Cmd + =
Zoom out: Cmd + -

Enjoy.

Friday, November 4, 2011

Helpful shortcuts 1

As you move through the workflow, adding layers to your image is essential. As it’s likely that you'll add many layers, here's a helpful tip that can save you a number of clicks (and thus save a ton of time).

New layer with dialog box: Cmd + Shift + N
New layer without dialog box: Cmd + Shift + Alt + N

Enjoy.

Thursday, November 3, 2011

MultiMedia Forensics Innocence Project?

Months ago, Larry E. Daniel posted a call for a Digital Forensics Innocence Project. Referencing another article's comment, ""What we need is a Computers Forensics version of the Innocence Project. We need experts who believe in the presumption of innocence and are willing to spend the time it takes to dig through logs, registry entries and hard drives to find exculpatory material when present. Prosecutors who look for – and presume – guilt do selective searches for data supporting guilt; those accused rarely have the resources to counter such selective evidence," Larry goes on a slightly more moderate tone to say, "I agree with him in principal, considering that there are people who are charged with crimes who do not have the resources to hire experts. And in cases where the client cannot meet the standard to be declared indigent and receive funding for an expert, I believe that we as experts in the field should be willing to take on a reasonable number of pro bono cases."

One of the things presented in the NAS report is the strangle hold that police crime labs have on the forensic science process. Finding an expert that you can afford, who is not part of a police crime lab, can be difficult. The problem is ... we have to get there. There are a few labs out there. Price is driven by a combination of supply/demand, the cost to operate, and the price set by the courts (when they're paying the bill).

I'd love to see some version of the Innocence Project that includes digital multimedia forensics. If it ever comes ... sign me up.

Enjoy.

Wednesday, November 2, 2011

Perry v. New Hampshire looks at eyewitness testimony

This just in from USA Today: "Supreme Court justices on Wednesday challenged the notion that testimony from arguably unreliable eyewitnesses should be specially scrutinized at trial because of how it can lead to wrongful convictions.

"Why is unreliable eyewitness identification any different from unreliable anything else" introduced at trial, Justice Antonin Scalia asked during arguments in a New Hampshire case. "Eyewitness identification evidence is unique," responded lawyer Richard Guerriero. He represents a man whose theft conviction was based partly on the report of a woman who said she watched him out her apartment window. Guerriero called mistaken IDs "the leading cause of miscarriages of justice."

Justice Elena Kagan said jailhouse informants could also create an especially "unreliable" category. "I understand you have very good empirical evidence which should lead us all to wonder about the reliability of eyewitness testimony," she said. "I'm just suggesting that eyewitness testimony is not the only kind of testimony which people can do studies on and find that it's more unreliable than you think."

Longstanding national concerns about the trustworthiness of eyewitness accounts formed the backdrop of Wednesday's dispute. The American Psychological Association, which has entered the case on the defendant's side, says, "Controlled experiments as well as studies of actual identifications have consistently found that the rate of incorrect identifications is approximately 33 percent."

Supreme Court cases dating to the 1960s have similarly stressed that eyewitness identifications are particularly untrustworthy and can lead to tainted jury verdicts and injustice. The question Wednesday is what safeguards for due process of law and fairness are necessary.

New Hampshire Attorney General Michael Delaney, urging the court to uphold the theft conviction, said identification evidence should be specially reviewed by a judge only when police obtained the ID through an unnecessarily suggestive police method — for example, in photos shown to a witness. The federal government and 29 states are siding with New Hampshire, urging the high court to leave the question of eyewitness reliability generally to a jury ..."

Click here to read the rest of the story.

Enjoy.

Tuesday, November 1, 2011

Early PS CS6 beta leaked

Here's a link to commentary on leaked beta info for Photoshop CS6.

Enjoy.

Friday, October 28, 2011

Leahy Bill? Don't hold your breath

I normally don't wade into the turbulent world of politics, but I am going to today ... sort of. I attended a presentation recently, and (reading between the lines) I think that those who believe that the Leahy Bill (Criminal Justice and Forensic Science Reform Act) is dead in the water and nothing is going to happen are going to be in for a big surprise.

Meet The Executive Office of the President of the United States' Subcommittee on Forensic Science (SoFS).

According to their web site, "The purpose of the Subcommittee on Forensic Science (SoFS) is to advise and assist the Committee on Science (COS), the National Science and Technology Council (NSTC), and other coordination bodies of the Executive Office of the President on policies, procedures and plans related to forensic science in the national security, criminal justice, and medical examiner/coroner systems at the local, state and federal levels."

Ok. So what do they want to do with their office space? Good question. Here's what they say are their goals and objectives, "This Subcommittee was created to assess the practical challenges of implementing recommendations in the 2009 National Research Council (NRC) report entitled Strengthening Forensic Science in the United States: A Path Forward, and to advise the White House on how best to achieve the goals outlined in that report. The SoFS is charged with developing practical and timely approaches to enhancing the validity and reliability of the federal government’s forensic science activities. This includes ensuring that regional, state and local entities adopt best practices in forensic sciences, and facilitating a strong coordinated effort across federal agencies to identify and address important federal policy, program and budget matters."

With me so far. No opinion yet ... just straight reporting from their web site.

Begin opinion: Look at the purpose statement. Their purpose is to advise on forensic science as it relates to criminal justice (among other things) at the federal, state, and local levels. Their goals include advising the White House on how best to implement the recommendations contained in the NAS report. Now read this statement again, "This includes ensuring that regional, state and local entities adopt best practices in forensic sciences, and facilitating a strong coordinated effort across federal agencies to identify and address important federal policy, program and budget matters." How does the federal government assure compliance in other areas of policy? With money. Again, my opinion and my observations are thus - soon enough you'll be faced with a choice; implement the recommendations or face the loss of federal funds. No need for Congress to act. No need for the Leahy Bill. This will come by way of regulation, enforced with a simple tool (money). Don't believe me? How was "education reform" accomplished? By attaching funding strings to education bills like NCLB. Remember, in a general sense, what the federal government funds, it controls.

Please don't get me wrong. Best Practices are necessary. Consensus standards are a good thing. Everyone in our business should be working from an SOP. Things like quality assurance/control, peer-review, training, and so on are great. How many police labs accredit their DME forensic functions? Not many. How many would be ready to accredit them soon? Not many. How many agencies could withstand the loss of some/all federal funds if their DME forensic functions were not under their main accreditation umbrella? Not many.

In doing my part to help things go right, I'm working with LEVA to create an accreditation program for DME labs. It will serve as an alternative for those agencies who are not ASCLD/LAB accredited and are performing DME forensics. More on this later.

Again, while my commentary may be a bit political in tone, it's more of a "here's the way I see it based on my recent experiences." I'd be interested to hear how you see this working, or how you see this affecting your agency.

Enjoy.